CVE-2023-4911 'Looney Tunables' Buffer Overflow in glibc tunable initialization

CVE-2023-4911 is a heap buffer overflow vulnerability in glibc's dynamic linker when processing the GLIBC_TUNABLES environment variable during program startup. The vulnerability allows local privilege escalation via buffer overflow in SETUID/SETGID programs. When __libc_enable_secure=1 (set for privileged binaries), parse_tunables() rewrites tunable names in canonical form back to a buffer that was allocated based on the original environment variable name length only, not accounting for the longer canonical names.

Located vulnerable code through grep search for __tunables_init and parse_tunables functions. Traced the call chain: __tunables_init (line 278) calls tunables_strdup() which allocates buffer for environment variable name only (line 293), then passes buffer+offset to parse_tunables() (line 295). Inside parse_tunables(), when __libc_enable_secure is true (secure mode for SETUID binaries), lines 235-241 write canonical tunable names back without bounds checking. The canonical names come from tunable_list and are longer than the original abbreviated names, causing heap buffer overflow. The buffer allocated by tunables_strdup() is sized only for the name length (e.g., 'GLIBC_TUNABLES'=16 bytes) but must hold expanded canonical tunable names (e.g., 'glibc.malloc.check').", The vulnerability can be fixed by: (1) Allocating a larger buffer in tunables_strdup() that accounts for the longest possible canonical tunable name expansion, or (2) Adding explicit bounds checking in parse_tunables() before writing canonical names to prevent off from exceeding buffer bounds, or (3) Using a separate working buffer for canonical name rewriting instead of writing back to the original buffer. The most robust fix implements bounds checking that validates off + len_of_canonical_name <= allocated_size before each write operation.", The vulnerability was confirmed by examining: (1) tunables_strdup() allocation (lines 47-64) which allocates size_of_input_name+1 only; (2) __tunables_init() buffer passing (line 295) which passes this small buffer to parse_tunables(); (3) parse_tunables() canonical name writing (lines 235-241) which writes without bounds checking in secure mode. The PoC confirms lines 235-241 as the vulnerable code location.", ["buffer-overflow", "glibc", "CVE-2023-4911", "heap-overflow", "privilege-escalation", "tunables", "environment-variable"]